HNHacker News
TopNewBestAskShowJobs

ValdikSS

1,446 karma · joined December 29, 2014

submissionscomments
ValdikSS··on Jabber/XMPP: How Do We Gain Traction?
Everybody has switched to OMEMO. It's the same encryption standard which Signal uses. It supports multiple devices and encrypted group chats as well.
ValdikSS··on Jabber/XMPP: How Do We Gain Traction?
>If you tell people "on Android you should use this app, on iOS use that app" - you lose regular people fast.

People don't use single browser and single email client, why IM should be different? It's a deficiency when you're forced to use a single "official client".

ValdikSS··on Jabber/XMPP: How Do We Gain Traction?
XMPP has brilliant session management, it reconnects more seamlessly than many other protocols on mobile. It literally reconnects (rejoins the same session within different TCP connection, not replaces it with a new session).

>Also sending media (or even rich text) never really worked as each client implemented it differently.

Everyone use HTTP upload nowadays, it works all the time.

ValdikSS··on (conf talk) Liberating the A100 beast inside Nvidia's CMP 170HX e-waste
The talk about steps it took to hack into Nvidia CMP 170HX cards to unlock the performance and use all 64 GB soldered RAM instead of stock 8/10 GB.
ValdikSS··on Android NAT-T keepalive offload bypasses VPN lockdown
It has been reported to Google (as a security bug) and to GrapheneOS as a comment in one of the very similar VPN leak issue on github. GrapheneOS has deleted my comment, probably because they assumed it was AI-generated or something, I've copied the report I sent to Google there.
ValdikSS··on JetKVM Mini
Actually yes, why not? All the professional documentation has glossary in it, btw.
ValdikSS··on Android NAT-T keepalive offload bypasses VPN lockdown
Android has a way to bind the socket to the interface: Network.bindSocket, this is a setsockopt(SO_BINDTODEVICE) wrapper with access control.

The access to it is controlled by the VPN application. Some applications could be allowed to connect directly when the VPN is active and routing all the traffic by default, some could use VPN if configured not to use it by default.

However starting with Linux kernel 5.7, the unprivileged userspace can now call setsockopt(SO_BINDTODEVICE) directly and use VPN or non-VPN interface even if restricted by the VPN client.

Not fixed in any Android (incl. Graphene, which has fixes for other leaks, but not this) to the day.

PoC is as simple as "curl --interface [ifname, not IP] ifconfig.co" in termux.

ValdikSS··on Don't let anyone take away your big box of cables
Do you have flea markets in DE? I'm pretty sure 10 kg of cables could be sold for more than €100 in a single day. Is it not common in DE?
ValdikSS··on How to build a printer
Oh no, I wasn't, and that's definitely not my comfort zone. I mess with the printers and printing stack due to anger, not because I like it.

It's bugs on bugs, with bugs chasing bugs! So little developers, so complex stack with 25 years of technical debt, and little community around because it's not a sexy technology to be involved in.

That's why I have to dive deep and fix my bugs myself if I want to make it work properly as I would like it to. I also ended up making my own print server device, because China did not make a proper one for some reason for all these years.

ValdikSS··on How to build a printer
PDF is very, very complicated standard which can't be handled properly on tiny MCUs with reasonable performance and spec conformance:

    - 4 font formats
    - 9 image formats
    - blending with transparency
    - different colorspaces, each image could use its own on the page
    - different dithering algorithms, each image with its own
    - the page can have elements from another pages (global elements)
This is only a small part from the top of my head.

Common simple home printers absolutely should not accept regular PDF as an input: thanks to Apple and IETF we now have Apple Raster and PWG Raster for printers, as a part of AirPrint and IPP Everywhere/Mopria driverless printing standards, which are very similar but have slightly different options and headers. It's a simple raster input for printers specifically.

Some companies, such as HP, invented a "raster PDF": PCLm / PCLms. Don't be confused by the name, it's a regular standard-conforming PDF which contain nothing but a full-page JPEG on each page, and don't use any other features. It's created only to be able to open "printed page" (driver output) in a standard PDF viewer on a PC for debugging or business logging needs, but otherwise it's like a regular JPEG with additional per-page metadata.

ValdikSS··on How to build a printer
>penguin would shrink the result to fit its screen. >I declared A5 and Letter paper, media type stationery, and an output bin called face-up.

You can (and should!) define exact dimensions of your screen in `media-size-supported`. It will probably be a non-standard IPP name, that's why you should define that in `media-supported` as `om_NNNmmxYYYmm` or `oe_NNNinxYYYin`

That way you don't need to scale the incoming data, the PC will format it exactly to the dimensions of the screen.

Both PWG Raster and Apple Raster support 1-bit-per-pixel mode (instead of 8-bit-per-pixel you use), that's why the input could be 8 times less in size. Use `print-color-mode-{supported,default}=bi-level` instead of `monochrome` for that. And also tune `urf-supported`'s `W` option, use `W1` for this case.

The screen/dithering could be ass in 1-bit mode, see https://github.com/OpenPrinting/libcupsfilters/pull/160 where I added more dithering options (Linux-only though, Apple seems to abandon their CUPS).

ValdikSS··on The NX bit is not just about security
I wrote an 'unlocking exploit' as a kernel module some years ago, and obfuscated it with a bit of self-modifying code.

It could not make it work reliable. No matter which barries I set, I could not understand why is it not reliable, and had to remove the modifying code in the end.

I guess I hit the issue you've described, and now I know. Thanks!

ValdikSS··on I Changed My License
>MIT and source out on GitHub is the easiest way to build trust. You will find that some people simply "steal" your work in this arrangement, but much like with movie piracy I don't think they ever intended to compensate you or anyone else.

You've chosen the license which allows "stealing", why did you do that if you don't like that? Nobody forced you to do that, I hope.

How can I trust the person who published their code with the strict legal terms, but becomes sad when other people use their code exactly as the author said it could be used?

Every once in a while I read discussions about licenses, and puzzled every time why the author of the software chooses free license when the freedom of copying and distribution is seem to them as pirating. If the license is not suitable for you, why choose it?!

Licenses are about legal possibilities. You're looking for social/moral terms instead if I understood you correctly (something like CoC).

ValdikSS··on I Changed My License
>A long time ago, I didn’t mind huge tech companies getting rich partially via open source, now I do.

Is the concern that anybody will be earning money on your software (just that), or that you won't get any money, or that they will earn money and don't give back the code?

If the company earns money and opens the code, is that OK for you?

Just for you and for everyone information, Richard Stallman himself told people not only to sell their own software, but the software written by others as well!

> Actually, we encourage people who redistribute free software to charge as much as they wish or can. If a license does not permit users to make copies and sell them, it is a nonfree license. If this seems surprising to you, please read on.

https://www.gnu.org/philosophy/selling.html

AGPL, just as all other GPL, does not prohibit selling the software. If you goal is to make your software unsellable, please use your own licensing terms (there's nothing wrong with that!!!)

ValdikSS··on How Fairphone built the Fairphone Gen 6+
?

Even Steam Deck has a custom APU made specifically for it. Call it "customized" if you don't like "custom".

ValdikSS··on How Fairphone built the Fairphone Gen 6+
Well yes, I agree, but the option is there.
ValdikSS··on Nearly impossible? How Fairphone built the ethical, repairable Fairphone Gen 6+
With a charging input + 3.5mm dongle?

https://ae-pic-a1.aliexpress-media.com/kf/Sfa5566c711b14a4aa...

ValdikSS··on Nearly impossible? How Fairphone built the ethical, repairable Fairphone Gen 6+
Desktop computers work because Intel and AMD provide support to their chips to Windows and Linux, because these chips are used for desktop and servers, and these OS are what their customers use.

Mobile chips are not used for desktop and servers, not used for Windows and Linux. They are used for Android, and that's a 98% of the market. The customers of the chips (the companies which develop devices on the chips) just don't use Windows or Linux, that's why there's no reason for a chip company to support it.

Android does not use desktop/server firmware, desktop/server bootloader, and even desktop/server stock Linux kernel. They have their own Generic Kernel Image with the Android patches on top, strict Google requirements for the booting and working process, etc.

PC operating systems are supplied by third parties that are not part of the computer manufacturer, motherboard or processor vendor. All component manufacturers must write drivers for Windows, certify them with Microsoft, and make sure that their device works properly ideally on any computer. You, the user, buy (or obtain) a copy of the operating system from the operating system company.

The operating system for a appliance (smartphone) comes with the appliance itself (as a bundle), and is supplied by the appliance manufacturer, not by operating system manufacturer. The manufacturer of electronic components does not need to contact the creators of the operating systems, they write a driver for Android kernel (yes, for Android kernel, with all its wakelock subsystems and such in mind) and gives it to the manufacturer of the appliance directly (and sometimes only supplies hardware, and the driver must be made by the manufacturer of the appliance).

ValdikSS··on Nearly impossible? How Fairphone built the ethical, repairable Fairphone Gen 6+
>but standard enough that people by binned playstation 5 motherboards to use as computers

That doesn't mean that all the features are enabled right from the factory, or that the compatibility with already existing features is lost.

Modern chip's security features are pretty complicated and include hardware patches, hardware debug authentication, multiple provisioning states (and multi-key hierarchy for that), RMA states to clear all the private information, etc.

>Switch runs on basically the same Nvidia Tegra CPU/GPU as multiple android tablets.

Yes, and the one which got cracked with a bootrom vulnerability ;)

That's a pretty working motivation for a chip company to improve their chip security when the company as beefy as Nintendo tells them that their chip is vulnerable they're losing money because the customers can play for free ;). I'm pretty sure patchable bootroms started to be common only after Switch hack.

ValdikSS··on How Fairphone built the Fairphone Gen 6+
iPhone is top-of-the-line as well, because they control the whole software and the whole hardware (starting from basically all the chips). That's very rare in the industry.

There are just a bunch of companies which afford to do the same. Maybe Xiaomi will be the next one.

ValdikSS··on How Fairphone built the Fairphone Gen 6+
The headphone jack is inside USB-C connector. You can use USB-C-to-3.5mm passive (!) cable to connect your 3.5mm headphones, or you can buy 3.5mm headphones with USB-C audio connection.

There's no additional DAC involved, the analog audio is already on a USB-C pins.

ValdikSS··on How Fairphone built the Fairphone Gen 6+
GrapheneOS is like a veteran and war zone expert: for them, not only the external environment is considered extremely hostile that you should leave your house only wearing an armor and with bodyguards, but also the internal environment is hostile: your bodyguards could be bribed and work against you, that's why you need to somehow be protected against that as well.

Just as physical security, digital security most of the time not as radical, and tradeoffs are usually accepted, especially when they are "invisible": hardware and software security features are usually not mentioned in the specs and the regular and even power user just don't know most of them and what do they do.

When GrapheneOS says "private" and "secure", they mean top-of-the-line security features, updates as soon as possible, all available mitigations against zero-days and insecure code which will limit the impact before the patch, etc. Security as in a killdozer.

When other say "private" and "secure", most of the time it means: "we've followed all the recommendations applicable to our development budget, device price point, and support life time". Graphene does not like that definition of these words.

For smartphone, chip manufacturer goal is not to protect the user at all costs, but to provide reasonable security features for the price.

BUT the goal of chip manufacturer to protect the device at all costs is for… game consoles! That's why Xbox, PlayStation, Switch all run on a custom silicon and not an ordinary chips!

ValdikSS··on Restoring 5 GHz Wi-Fi on an LG C5 by changing its webOS region
Linux's wireless-regdb has proper 5G regulatory information for at least SA, CY, EG, QA, at least since 2017, just checked. The TV in the repo is 2025 year model.
ValdikSS··on How to get a free .arpa domain
You can get a TLS certificate on .arpa.

https://crt.sh/?q=%25.arpa&exclude=expired&group=none

There are websites as well

https://5.8.7.1.7.1.3.2.6.1.9.4.e164.arpa/

ValdikSS··on Suica, Japan's First IC Transit Card
I don't know how it works in your country, but in RU you only tap to get in, not to get out. There are no barriers to get out.

1. The card stores not only your ticket/cash data, but also your trips

2. You live far from the metro, so you ride by bus to the metro station. The metro station knows that you've just been on the bus (the bus activated 90 minutes window) and either don't account you or gives you a discount

3. You can also top-up the card using your smartphone with NFC. The smartphone writes data to the card (and can read your balance and a trip of course). But also, if your smartphone don't have NFC or you don't want to install the app, you can top-up using the web and write it to the card anywhere (inside the bus / on a metro station) with the regular validator (it not only reads, but writes the data received from the net as well)

ValdikSS··on Debugging my new network, when 10 Gigabit Ethernet Runs at 300 Megabits
Another example: PCIe ASPM exit latency. Fast LAN speed (because the card does not have time to go into sleep) but low internet speed (manages to enter ASPM if the host is at least 3ms away)

https://lore.kernel.org/intel-wired-lan/803760bf-04ff-4b23-8...

ValdikSS··on Suica, Japan's First IC Transit Card
>tap in/tap off sucks no matter how good the system is. It is fundamentally a wrong think.

Tap system doesn't have to end billing period on tap out, if that's what you're trying to say.

Moscow/Saint Petersburg cards have many options which you can combine (add-on packages), as well as a regular balance (wallet).

"90 minutes unlimited" does how it is named, and if you travel first by metro, then switch to a bus, you pay less in the bus.

ValdikSS··on The brain may be about to have its Ozempic moment
Hooray fatal insomnia
ValdikSS··on Jabber/XMPP: 25 Years of Digital Independence
XEP-0479: XMPP Compliance Suites 2023

https://xmpp.org/extensions/xep-0479.html

ValdikSS··on Jabber/XMPP: 25 Years of Digital Independence
Daniel (the author of the linked article) was one of the people to define profiles for human chatting: https://xmpp.org/extensions/xep-0479.html
← PreviousPage 2 of 14Next →